Skip to content

Commit 5ca71a7

Browse files
author
Marti
committed
Added an extra check to MLU bounds
Thanks to Ibrahim el-sayed for spotting the bug
1 parent 696d6b1 commit 5ca71a7

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

Diff for: src/cmstypes.c

+1
Original file line numberDiff line numberDiff line change
@@ -1460,6 +1460,7 @@ void *Type_MLU_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER* io, cmsU
14601460

14611461
// Check for overflow
14621462
if (Offset < (SizeOfHeader + 8)) goto Error;
1463+
if ((Offset + Len) > SizeOfTag + 8) goto Error;
14631464

14641465
// True begin of the string
14651466
BeginOfThisString = Offset - SizeOfHeader - 8;

0 commit comments

Comments
 (0)